Has your organization formally documented the incident response roles and responsibilities for both internal teams and external suppliers?

Clarity of incident roles is the focus here, specifically whether you have documented incident response responsibilities for both your internal teams and your external suppliers. Clear role definition prevents confusion during incidents, ensures proper coordination, and establishes accountability for incident response activities across organizational boundaries.

Evidence could include an Incident Response Plan document that contains a RACI matrix (Responsible, Accountable, Consulted, Informed) or similar responsibility chart that maps specific incident response activities to roles within your organization and to relevant supplier organizations. The document should clearly indicate which party is responsible for incident detection, analysis, containment, eradication, and recovery activities.